New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances

A critical vulnerability, dubbed CosmosEscape, in Microsoft Azure Cosmos DB could have let attackers seize control of virtually every database hosted on the service, including Microsoft’s own internal systems. The vulnerability resided in Cosmos DB’s Gremlin API and, if exploited, could have enabled a cross-tenant attack affecting millions of customer workloads and Microsoft’s internal infrastructure. Understanding these structural risks is increasingly vital when evaluating broader cloud platform security across multi-tenant enterprise environments. New CosmosEscape Vulnerability Wiz researchers were experimenting with Gremlin, a popular graph query language supported by Cosmos DB, when they noticed an...

Read the full article at the source.